MAL-2025-63837 Malicious code in kresna-dodol52-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4976be4262d6d79f74353014c64d39f74fee0cc33d688b2ae38b2c549427c896 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63916 Malicious code in kurniawan-klanting92-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ca5ff62e64b6d231fdcc309f6e83dd4817d0132467a2fa5e89ed94c12eb6d85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65856 Malicious code in utomo-rujaksoto36-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57d89e12e2712f0b31c507f59eee3763339facba014fa11286d3eb28b5630143 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65912 Malicious code in vera-rojak45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 749a352879c60c32d7079674e0c63a2f62886468e95aa4d538182d2468d93dc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63139 Malicious code in gilang-toge26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716a076ce42d20253755b9139a080e23c7cb28aee4d5d2e97df34096de9d60db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andi-nasipecel65-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77bb10e4a15a5a99201d8c3ad70c92a851b4b66fd3021791be17d862a2383bc0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64277 Malicious code in maya-kue47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b98ec1522260b04edc6c81dad900da30bb400cb56b4ced5d7d2f512637aa865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SAP NetWeaver Application Server Java 路径遍历漏洞

SAP NetWeaver Application Server Java is an application server from SAP Germany that provides a Java runtime environment. The product is primarily used to develop and run Java EE applications. A path traversal vulnerability exists in SAP NetWeaver Application Server Java, which stems from the...

QLCoder: A Query Synthesizer for Static Analysis of Security Vulnerabilities

Static analysis tools provide a powerful means to detect security vulnerabilities by specifying queries that encode vulnerable code patterns. However, writing such queries is challenging and requires diverse expertise in security and program analysis. To address this challenge, we present QLCoder...

PT-2025-46238

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java affected versions not specified Description An information disclosure issue exists in SAP NetWeaver Application Server Java. An unauthenticated attacker can access internal metadata files through crafted...

CVE-2025-64522

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webhook URLs which are not validated. An attacker can access internal services, private networks, or cloud metadata endpoints by configuring malicious webhook URLs. PoC ssh localhost webhook crea...

CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

CVE-2025-64522

CVE-2025-64522 affects Soft Serve, a self-hosted Git server. The SSRF vulnerability arises from unvalidated webhook URLs, enabling repository admins to configure webhooks that target internal services, private networks, and cloud metadata endpoints. Affected components include Webhook Creation (p...

CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

GHSA-VWQ2-JX9Q-9H9F Soft Serve is vulnerable to SSRF through its Webhooks

SUMMARY We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. AFFECTED COMPONENTS VERIFIED 1. Webhook Creation...

Soft Serve is vulnerable to SSRF through its Webhooks

SUMMARY We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. AFFECTED COMPONENTS VERIFIED 1. Webhook Creation...

Malicious code in tough_gorilla_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d25633888a1c8107a276ec0153368e10a298ed43a317c084e5b42c9586efa40c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in military_swordtail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2dfb223f6fb14212bb80a94e507835f60ea36b1eea217d011a848863602b790 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...